Privacy Policy
LESARI OÜ
Version: 2.0
Last updated: 27 October 2026
Effective date: 27 October 2026
This Privacy Policy explains how LESARI OÜ (“LESARI”, “Company”, “we”, “us”, or “our”) collects, uses, stores, protects, and shares your personal information when you visit our website, create an account, place an order, or otherwise interact with our products and services.
LESARI OÜ is the data controller responsible for the personal data described in this Policy. We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), and other applicable data protection laws. Where you are located outside the European Economic Area, the regional supplements in Section 17 also apply to you.
LESARI follows the principle of data minimisation and processes only the personal data necessary to provide its products and services.
This Policy should be read together with our Cookie Policy, our Children’s Photo Policy, and our Terms of Service.
1. Controller Identity and Contact Details
| Company | LESARI OÜ |
| Legal form | Osaühing (private limited company), Republic of Estonia |
| Registry code | 17372020 |
| VAT number | EE102926260 |
| Registered address | Kaupmehe tn 7-120, Kesklinna linnaosa, 10114 Tallinn, Estonia |
| Commercial Register | Estonian Business Register (Äriregister) |
| General and privacy enquiries | [email protected] |
| Contact form | lesari.com/en/contact |
| Response time | Within 48 hours |
We do not operate a customer telephone line. Every enquiry sent to the addresses above, or through the contact form on our website, receives a reply within 48 hours.
Data Protection Officer. LESARI has assessed its processing activities against Article 37 GDPR and has not appointed a Data Protection Officer, as our processing does not involve large-scale systematic monitoring or large-scale processing of special categories of data. All privacy enquiries should be addressed to [email protected], which is monitored by the person responsible for data protection within LESARI. We will keep this assessment under review as our business grows.
2. Information We Collect
We collect the following categories of personal information, depending on how you interact with our website and services.
2.1 Information you provide directly
Account and order information
- Full name
- Email address
- Billing address
- Shipping address
- Telephone number (where provided)
- Language and country preferences
- Account credentials (password stored only in hashed form)
- Order history and correspondence with customer support
Payment information. Payment card details are collected and processed directly by our payment service providers. LESARI does not receive, store, or have access to your full card number. We receive only a transaction reference, the payment status, the amount, and, where provided by the payment provider, the last four digits of the card and the cardholder name.
Personalisation information
- The child’s first name
- The child’s age or age group
- Personalised dedication or custom text
- Appearance preferences and character options
- Uploaded photographs
- Other personalisation details voluntarily provided by the customer
Information about third parties. If you place an order to be delivered to another person (for example, as a gift), you provide us with that person’s name and delivery address. You are responsible for ensuring you may lawfully share that information with us. We use it solely to deliver the order and we inform the recipient, on request, how their data was obtained.
2.2 Information collected automatically
- IP address
- Browser type and version
- Device type and identifiers
- Operating system
- Pages visited, referring pages, and website usage data
- Data collected through cookies and similar technologies (see our Cookie Policy)
- Diagnostic, error, and security logs
2.3 Information we do not collect
We do not knowingly collect personal data directly from children (see Section 6). We do not collect special categories of personal data within the meaning of Article 9 GDPR, and we do not use photographs to create biometric identifiers (see Section 5.4).
3. How We Use Your Information and Our Legal Bases
We process personal data only where we have a lawful basis under Article 6 GDPR. The table below sets out each purpose, the data involved, and the legal basis we rely on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating, producing, and delivering your personalised product | Account, order, personalisation data, uploaded photographs | Performance of a contract (Art. 6(1)(b)); consent for photographs of children (Art. 6(1)(a)) |
| Processing payments and preventing payment fraud | Order and transaction data | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests in fraud prevention (Art. 6(1)(f)) |
| Creating and managing your customer account | Account data | Performance of a contract (Art. 6(1)(b)) |
| Order confirmations, delivery updates, and service notifications | Contact and order data | Performance of a contract (Art. 6(1)(b)) |
| Responding to enquiries and customer support requests | Contact, order, and correspondence data | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Handling complaints, returns, and warranty claims | Order and correspondence data | Legal obligation (Art. 6(1)(c)); performance of a contract (Art. 6(1)(b)) |
| Improving our website, products, and personalisation technology | Technical and usage data, aggregated order data | Legitimate interests (Art. 6(1)(f)); consent where analytics cookies are used |
| Website analytics and performance measurement | Technical and usage data | Consent (Art. 6(1)(a)), via our cookie banner |
| Marketing emails and newsletters | Contact data, marketing preferences | Consent (Art. 6(1)(a)); or legitimate interests for existing customers where permitted by Article 13(2) of Directive 2002/58/EC |
| Website security, abuse prevention, and log retention | Technical data, IP address | Legitimate interests (Art. 6(1)(f)) |
| Accounting, tax, and statutory record-keeping | Order and invoice data | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising, or defending legal claims | Any relevant data | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
Our legitimate interests. Where we rely on legitimate interests, those interests are: operating and improving our business, keeping our website and customers secure, preventing fraud and abuse, responding to enquiries, enforcing our Terms of Service, and protecting our legal rights. We have assessed in each case that these interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests at any time (see Section 12), and you may obtain further information about our balancing assessment by contacting [email protected].
Withdrawal of consent. Where we rely on consent, you may withdraw it at any time without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and it does not affect processing carried out on another legal basis.
We do not sell your personal information. We do not sell, rent, or trade personal data, and we do not share personal data with third parties for their own independent marketing purposes.
4. Marketing Communications
We send marketing emails only:
- where you have given your consent (for example, by subscribing to our newsletter); or
- where you are an existing customer, in relation to our own similar products, and you were given a clear opportunity to object when your data was collected and in every subsequent message.
Every marketing email contains a one-click unsubscribe link. You may also manage your preferences in your account or by writing to [email protected]. Unsubscribing from marketing does not stop transactional messages about orders you have placed.
Marketing measurement. We do not use advertising pixels or audience-matching services, and we do not share contact identifiers, hashed or otherwise, with advertising platforms.
5. AI Processing and Personalisation
LESARI creates personalised products using information provided by the customer together with artificial intelligence (“AI”) and other automated technologies.
5.1 What we process and why
To create a personalised product we may process the child’s name, age or age group, uploaded photographs, appearance preferences, personalised messages or dedications, language preferences, and other customisation details submitted during the ordering process. This information is used solely to create, produce, deliver, and support the product you have ordered.
5.2 Transparency about AI-generated content
In accordance with Article 50 of Regulation (EU) 2024/1689 (the “AI Act”), we inform you that the illustrations and certain text elements in our products are generated or substantially modified by artificial intelligence. Where technically feasible, AI-generated image content produced by our systems is marked in a machine-readable format. AI-generated results are artistic interpretations and are not intended to be exact photographic reproductions of any individual.
5.3 No training of public AI models
LESARI does not use customer photographs, personalisation data, or other uploaded content to train publicly available artificial intelligence models. This restriction is imposed contractually on every processor that handles this data on our behalf.
5.4 No biometric processing
LESARI does not use facial recognition and does not create, store, or compare biometric templates. Photographs are not processed for the purpose of uniquely identifying a natural person and therefore do not constitute biometric data within the meaning of Article 9(1) GDPR. We do not use photographs to infer health, ethnicity, or any other special category of personal data.
5.5 No automated decision-making with legal effect
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Automated content-safety screening may flag an uploaded image for human review; no order is refused on the basis of an automated decision alone.
5.6 AI service providers
Illustrations are generated using AI services supplied by established third-party technology providers, acting as our processors under written agreements meeting the requirements of Article 28 GDPR.
We use enterprise service tiers under which the provider is contractually prohibited from using submitted content to train or improve its models. Providers may process uploaded material only to carry out our instructions, and must delete it within defined periods.
The categories of recipients are set out in Section 8 and retention periods in Section 7. If you wish to know which specific provider handles a particular step, write to [email protected] and we will tell you.
6. Children’s Personal Data
Our website and services are intended for use by adults purchasing products on behalf of a child. You must be at least 18 years old, or the age of majority in your country, to create an account or place an order.
We do not knowingly collect personal data directly from children. Any information relating to a child, including names and photographs, must be submitted by a parent, legal guardian, or another person with the legal authority to do so. By submitting such information you confirm that you hold that authority and all necessary permissions.
Children’s photographs are used exclusively to create the requested personalised product. They are never used for advertising, marketing, profiling, or for training publicly available AI models, and we do not maintain a searchable database or library of children’s photographs.
Detailed information on how photographs of children are handled, including retention periods, deletion, and the rights of parents and guardians, is set out in our separate Children’s Photo Policy, which forms part of this Privacy Policy.
If you believe that a child’s personal data has been provided to us by someone without the authority to do so, contact [email protected] immediately and we will act on your request without undue delay.
7. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, and thereafter for the periods required by law.
| Category of data | Retention period | Basis for the period |
|---|---|---|
| Original photographs uploaded for personalisation | Deleted within 30 days of upload. Where a processor keeps a technical copy under its own security controls, that copy is deleted in all cases within 60 days of upload | Data minimisation; see Children’s Photo Policy |
| Final personalised artwork and print files (contain no photograph) | 24 months after delivery, to enable reprints and warranty claims for the duration of the legal guarantee | Legitimate interests; performance of contract |
| Order records, invoices, and accounting documents | 7 years from the end of the financial year | Estonian Accounting Act (Raamatupidamise seadus) |
| Customer account data | For the life of the account, then deleted within 30 days of closure (except records subject to statutory retention) | Performance of contract |
| Customer support correspondence | 24 months from the last contact | Legitimate interests |
| Consent records (including consent to process a child’s photograph) | 3 years, as evidence of compliance | Accountability, Art. 5(2) GDPR |
| Marketing contact data | Until consent is withdrawn, then suppression-list entry only | Consent |
| Website and security logs | 6 months | Legitimate interests |
| Data relating to a live dispute or legal claim | Until the claim is finally resolved plus the applicable limitation period | Legal claims |
When personal data is no longer required, it is securely deleted or irreversibly anonymised.
8. Recipients of Personal Data
We do not sell, rent, or trade your personal information. We share personal data only where necessary to provide our services or where required by law, and only with recipients bound by confidentiality and data protection obligations.
| Category of recipient | Purpose | Location |
|---|---|---|
| E-commerce and hosting platform | Website operation, order management | European Union |
| Content delivery, security and bot protection | Keeping the website available and protected | United States |
| Payment service providers | Payment processing, chargeback and fraud handling | European Union, with a parent company in the United States |
| AI and image-processing providers | Generating personalised illustrations | EU and United States |
| Print and fulfilment partners | Manufacturing and dispatching the personalised product | European Economic Area |
| Shipping and logistics providers | Delivery of orders | European Economic Area |
| Email and customer support tools | Transactional messages, support tickets | United States |
| Analytics providers | Website performance measurement (consent-based) | United States |
| Professional advisers, accountants, auditors | Statutory and professional obligations | EU |
| Public authorities and courts | Where disclosure is required by law | As applicable |
If you would like to know which specific service provider handles a particular category of data, write to [email protected] and we will tell you.
We may also disclose personal data in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.
All processors act only on our documented instructions under a written agreement meeting the requirements of Article 28 GDPR.
9. International Data Transfers
Some of our service providers are located outside the European Economic Area. Where we transfer personal data outside the EEA, we do so only where one of the following applies:
- the European Commission has decided that the country ensures an adequate level of protection (Article 45 GDPR);
- the transfer is governed by Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR), supplemented where necessary by additional technical and organisational measures identified in a transfer impact assessment; or
- another lawful transfer mechanism under Chapter V GDPR applies.
Transfers to the United States take place either under the EU–US Data Privacy Framework, where the recipient is certified, or under Standard Contractual Clauses.
You may request a copy of the safeguards applicable to a specific transfer by writing to [email protected]. We may redact commercially confidential terms.
10. Data Security
We implement technical and organisational measures appropriate to the risk, including:
- encryption of data in transit (TLS) and encryption at rest for uploaded images;
- role-based access controls and the principle of least privilege;
- multi-factor authentication for administrative access;
- segregated processing environments for personalisation workloads;
- logging, monitoring, and alerting for unauthorised access;
- contractual security obligations imposed on all processors;
- periodic review of access rights and security measures;
- staff confidentiality undertakings and data protection training.
No method of electronic transmission or storage is completely secure. While we take appropriate steps to protect personal data, we cannot guarantee absolute security.
The same honesty applies to deletion. When we delete personal data, we remove it from our systems and require our processors to delete their copies within defined periods. We hold them to that obligation, but we cannot inspect their infrastructure from the inside. This is why we minimise what we collect and how long it exists, rather than relying on deletion alone.
11. Personal Data Breaches
If a personal data breach occurs, we will assess it without undue delay and, where the breach is likely to result in a risk to the rights and freedoms of individuals, notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it, where feasible, in accordance with Article 33 GDPR.
Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly and without undue delay, describing the nature of the breach, its likely consequences, and the measures taken, in accordance with Article 34 GDPR.
We maintain an internal register of all personal data breaches, whether or not notifiable.
12. Your Rights
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we hold about you and obtain a copy;
- rectify inaccurate or incomplete personal data;
- erase your personal data (“right to be forgotten”);
- restrict processing in defined circumstances;
- object to processing based on legitimate interests, and to object at any time and without justification to processing for direct marketing;
- data portability — receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
- withdraw consent at any time, where processing is based on consent;
- not be subject to a decision based solely on automated processing producing legal or similarly significant effects; and
- lodge a complaint with a supervisory authority.
How to exercise your rights
Send your request to [email protected]. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
We will respond within one month of receiving your request. Where a request is complex or where we receive a number of requests, we may extend this period by up to two further months and will inform you of the extension and the reasons within the first month.
We may ask you for information reasonably necessary to confirm your identity before we act on a request. We will not use that information for any other purpose.
Limits. Some rights are not absolute. For example, we cannot delete data we are required by tax or accounting law to retain, and we may retain data necessary to establish, exercise, or defend legal claims. Where we cannot fully comply with a request, we will explain why.
Please note: because original uploaded photographs are deleted within 30 days of upload (Section 7), we may no longer hold the image that was the subject of your request.
13. Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
Our lead supervisory authority is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia
Email: [email protected]
Web: www.aki.ee
Lodging a complaint does not affect any other administrative or judicial remedy available to you. We would, however, appreciate the opportunity to address your concerns first — please contact [email protected].
14. Cookies and Tracking Technologies
We use cookies and similar technologies to operate our website, remember your preferences, measure performance, and maintain security. Non-essential cookies are placed only with your consent, which you may give, refuse, or withdraw at any time through our cookie banner and Cookie Preference Centre.
Full details, including the specific cookies used, their purposes, and their storage periods, are set out in our separate Cookie Policy.
15. Third-Party Websites
Our website may contain links to third-party websites, plug-ins, or services. We are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.
16. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our services, applicable law, technology, or business practices.
The current version is always published on this page together with its version number and “Last updated” date. Where a change is material — for example, a new purpose of processing, a new category of recipient, or a change in the legal basis — we will notify you in advance by email or by a prominent notice on our website, and, where the change requires it, we will obtain your consent.
Previous versions of this Policy are available on request from [email protected].
17. Regional Supplements
The provisions below apply in addition to the rest of this Policy where they are relevant to you. Where a regional supplement conflicts with another part of this Policy, the supplement prevails for the individuals it covers.
17.1 United Kingdom
LESARI is established in the European Union and does not target the United Kingdom market. We do not advertise in the United Kingdom, do not price in pounds sterling, do not offer UK-specific delivery options, and do not monitor the behaviour of individuals in the United Kingdom. On that basis we have not appointed a representative under Article 27 UK GDPR.
We do not refuse orders from customers who happen to be resident in the United Kingdom. Where we receive such an order, we process the customer’s personal data to the standard described throughout this Policy, which reflects the requirements of the EU GDPR — a standard materially equivalent to the UK GDPR.
Individuals in the United Kingdom may raise any concern with us at [email protected], and may lodge a complaint with the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom — www.ico.org.uk.
17.2 United States — California
If you are a California resident, the California Consumer Privacy Act as amended (“CCPA/CPRA”) gives you the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; to opt out of the “sale” or “sharing” of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
We do not sell personal information, and we do not share personal information for cross-context behavioural advertising as those terms are defined under the CCPA. We do not knowingly collect or sell the personal information of consumers under 16 years of age.
The categories of personal information we collect, our purposes, and the categories of recipients are described in Sections 2, 3, and 8 of this Policy. Our retention periods are described in Section 7.
To exercise your California rights, contact [email protected]. You may use an authorised agent; we will require proof of authorisation. We will respond within 45 days, extendable by a further 45 days where reasonably necessary.
17.3 United States — children
Our services are directed to adults. We do not knowingly collect personal information online directly from children under 13 within the meaning of the Children’s Online Privacy Protection Act (“COPPA”). Information about a child is provided to us by a parent or guardian in the course of placing an order. If you believe we hold information collected directly from a child, contact [email protected] and we will delete it.
17.4 Other jurisdictions
Where the law of your country of residence grants you rights that go beyond those described in this Policy, those rights are unaffected, and we will honour them to the extent they apply to us.
18. Contact
LESARI OÜ Kaupmehe tn 7-120, Kesklinna linnaosa, 10114 Tallinn, Estonia Registry code 17372020 · VAT EE102926260
Privacy and general enquiries: [email protected]